SPF record generator

What an SPF record generator gives you

What does an SPF record generator do? It gives you one SPF record for the platforms that send your mail. You get the right syntax and the right ending, and you see how many DNS lookups the record needs.

Your SPF record is one TXT record on your domain. In it, you list the servers that may put your domain in the envelope sender. A receiver checks the connecting IP against that list, then applies the all term at the end. Writing the record is the easy part. It goes wrong when there's a second record on the same name, a sender you forgot, or one include too many.

Merging into the record you already have

Give us your domain and we read the record you publish today. We add the senders you picked in front of the ending and mark what we added. Every other term stays where it was, in the same order, with the same qualifier.

We merge because most domains that lose a sender lose it when someone pastes a generated record over the old one. The include for the invoicing platform goes with it. Once DNS updates, that platform's mail fails SPF, and the new record gives you no clue what used to be there.

If we can't parse your record, we leave it alone. You get a clean record built from the senders you picked, with a note that we didn't change the published one. Editing a record we can't read would mean guessing at the rest of it.

The ten-lookup limit

RFC 7208 allows 10 DNS lookups for a whole SPF check. The terms that cost one are include, a, mx, ptr, exists and redirect. The count covers every term nested inside your includes as well as the terms in your own record. Receivers read the record left to right and stop at the first match. A sender they need an eleventh lookup to find gets permerror, and DMARC counts that as a failure. Senders they find within ten lookups still pass.

We resolve every include in the merged record and show the total above. If it goes over 10, we warn you before you paste it. The ten-lookup guide covers how to get lookups back. Run a record you've already published through our SPF checker to get the same total.

Where to publish the record

Publish one TXT record on the domain itself. Don't put it at _spf or on a subdomain, and never publish two. Two v=spf1 records on one domain return permerror, and receivers use neither. If you already have a record, replace it with the merged version above in one edit. The syntax reference covers each term and what it costs.

SPF breaks when a message is forwarded, because the forwarder's server makes the connection. DKIM still passes after forwarding, so publish both. Then publish a DMARC record to see which of your senders pass. The provider pages list the SPF and DKIM setup for each platform.

The other tools